PyPI/virtualenv CVE-2026-113716: medium 4.5

virtualenv: Builtin creation follows linked environment directories

Action: Upgrade virtualenv to 21.14.9 or later.

pip install virtualenv==21.14.9

Affected

Fixed versions

Sources

• osv: GHSA-cw65-gx24-rc82
• https://github.com/pypa/virtualenv/security/advisories/GHSA-cw65-gx24-rc82
• https://nvd.nist.gov/vuln/detail/CVE-2026-113716
• https://github.com/pypa/virtualenv/pull/3429
• https://github.com/pypa/virtualenv/commit/554d9f9d4f7758f5cf53f993031e29787f1f74c5
• https://github.com/pypa/virtualenv
• https://github.com/pypa/virtualenv/releases/tag/21.14.9

CVE-2026-113716 · published 2026-10-21T21:35:56Z · modified 2026-10-21T21:45:08.333551103Z · JSON